Chinese car, super spy? The issue comes to the fore following a Euro MP’s approach to BYD on 4 November. Cameras, geolocation and software actually collect sensitive information. But a technical capacity, a flaw and an intelligence operation are not the same. Norwegian cases, Chinese texts and Western decisions pose a serious risk, without establishing that any Chinese car is transmitting its observations to Beijing.
The connected car changed the nature of the car debate. At price, autonomy and road safety now add a question: who can see what it records? This question concerns drivers. It also involves armies, administrations and operators of critical infrastructure.
China occupies a special place in this discussion. Its manufacturers are expanding their international sales, while its legislation requires cooperation with intelligence services. Western authorities fear that industrial or commercial access will become a surveillance instrument. To measure this threat, however, it is necessary to examine vehicles, software and real access, rather than deducing a spying operation of a logo.
Chinese car: a political alert, not a verdict
On 4 November 2026, fourteen MEPs asked the European Commission to assess the potential threat posed by BYD cars. According to a news agency, they want a review by the European Cyber Security Agency and consider restrictions on public procurement. The French MP François Kalfon takes this initiative.
This follows the ban on BYD access at the US air base in Kadena, Japan, at the end of October. U.S. military officials claim a security risk that they consider unacceptable. The detailed technical elements justifying this assessment have not been made public in the documents examined for this article.
A military base may apply precautions before an incident is demonstrated. This decision therefore does not constitute a judicial finding of espionage or a general ban on Chinese vehicles in Europe. Similarly, asking for an evaluation in Brussels does not mean that it has already concluded.
BYD challenges the risk of access from China to the data of its European customers. The manufacturer claims that its European subsidiary does not make them available to its entities or Chinese third parties. That position must be included in the debate, along with requests for control.
What sensors can actually tell
A modern automobile produces several families of data. Computers measure speed, braking, battery load or technical defects. The navigation system processes a position. The cameras observe the road and, on some models, the driver’s attention. A voice assistant deals with commands. An associated phone can bring contacts and destinations.
Not all of these equipments exist on each vehicle. Their operation depends on the model, market, options and software version. A lidar measures distances; its presence does not show sending a map to a server. A parking aid camera can process an image in memory, then erase, without making a video archive.
However, localization is particularly revealing. A succession of journeys can reveal a home, a workplace and habits. Crossed with schedules, it can inform about the activity of a site. Sensitivity comes as much from the repetition and reconciliation of information as from a spectacular image.
A concrete example of telemetry can be found in BYD’s European Data Act notice. It includes speed, mileage, tire pressure and battery condition. Some categories can be collected and sent to servers every thirty or sixty seconds, depending on the function and configuration.
The same document describes update logs and diagnostics. He announces storage on Google Cloud in a data centre in Paris. These indications document industrial flows. They do not alone demonstrate clandestine capture or transfer to China.
Collection, Leakage, Piracy and Intelligence: Four Situations
Commercial collection is the first level. A manufacturer operates data for a service, diagnosis or improvement of a product. It must be able to explain their usefulness, shelf life and recipients. Excessive collection can harm privacy without being part of a state operation.
A leak is another problem. Normally reserved files become accessible by mistake or due to insufficient protection. Piracy implies unauthorized access to an account, server or embedded system. The manufacturer may be the victim, rather than the organizer.
The espionage still requires a different demonstration: who has obtained what information, by what means and for which recipient? The presence of sensors does not answer these questions. Evidence may be based on observed transmissions, documented access, or an investigation of the facts. None of these elements can be replaced by the sole nationality of an enterprise.
In Norway, recorded images and a risk of stopping
The Norwegian episodes illustrate these differences. In September 2026, vehicles rented for military exercise Hovedstad recorded images. The military discovered these recordings. The Norwegian Minister of Defence confirmed the episode in a parliamentary reply of 16 October and indicated that the data had been erased.
According to the Norwegian press, at least two of the vehicles were Deepal, a brand of the Changan group. This episode should therefore not be attributed to BYD. Public information shall establish a registration in vehicles. They do not demonstrate that the images were transmitted to the Chinese services. Consolidating the two statements would transform a security incident into an unestablished assignment.
Another case concerns buses. On 28 October 2025, the transport operator Ruter presented tests on a new Chinese Yutong and an older Dutch VDL. On the Yutong, digital access to updates and diagnostics included battery and power management.
Ruter concluded that the vehicle could, in theory, be stopped or rendered unusable by this access. The operator did not announce that he discovered a Chinese attack or published the demonstration of a malicious stop in circulation. His tests also indicated that the cameras were not connected to the Internet and did not transmit images or videos.
These results cannot be extended to all Chinese cars or even to all versions of a bus. In May 2026, the British Government indicated that updates of the Yutongs concerned in the United Kingdom should be carried out in a workshop. The destination market and technical configuration therefore change the risk assessment.
Why Remote Updates Concern
Remote updates can correct a vulnerability without reminding every car in the garage. They can improve security. But they also create a chain of trust: the vehicle must recognize the authorized software, check its integrity and prevent an unauthorized actor from taking control of it.
The danger depends on the accessible functions. Changing the multimedia interface is not equivalent to acting on braking. An application to open the doors does not necessarily allow access to driving calculators. The partition between these systems, the rights of technicians and the protection of servers are more important than the existence of an Internet connection.
The manufacturer’s control must also be distinguished from its diversion. Preconditioning a battery or starting a diagnosis is a normal function. Using without permission, or distributing compromised software to a fleet, is another scenario. The possibility must be tested and documented before being presented as an acquired capacity.
China’s framework has a specific concern
China’s 2017 National Intelligence Act explains some of the Western concerns. Article 7 requires organisations and citizens to support, assist and cooperate with intelligence under legal conditions. Article 14 allows the services to request the necessary assistance from the organisations and persons concerned.
The Chinese Cyber Security Act also provides technical assistance to national security and criminal investigation authorities. This provision is now included in article 30 in the version which entered into force on 1 January 2026. The references to the old article 28 must therefore be seen in their context.
These obligations contribute to the risk of State coercion. They do not prove that an application has targeted a specific manufacturer or that a European subsidiary has access to it. The analysis should examine the governance of the group, the authorized staff, the providers and the remedies available.
China also imposes its own restrictions on the processing of car data on its territory. Provisions which came into force in October 2021 regulate personal data and important data. They encourage treatment in the vehicle and subject certain transfers outside the country to a safety assessment. This system does not order the repatriation of all car data exported.
Chinese standards on automotive cybersecurity and updates also started to apply on January 1, 2026. Therefore, Beijing regards road data as a matter of security and sovereignty. The presence of these protections does not remove questions about the State’s access powers.
Guarantees must be verifiable
BYD claims that the images of its internal and external cameras are processed locally. His European presentation states that the panoramic camera does not store captured images. It also mentions a physical cache for a driver’s surveillance camera, referring to the characteristics of each model.
These statements are useful, but do not replace an independent audit. What actually comes out of the vehicle, what accounts can view the information, and what operations remain possible after an update. Control over a software version does not automatically guarantee the following versions.
The European location of a server is an important information, not a complete answer. Remote access from another country remains technically separate from the location of the records. Conversely, belonging to a Chinese group does not demonstrate the existence of such access. These assumptions can be separated by activity logs and empowerment checks.
Washington targets software and industrial chain
The United States has chosen a preventive approach. The federal rule finalized in January 2025 applies to certain automated connectivity or driving software, as well as communications equipment. It concerns links with persons under the ownership, control, jurisdiction or direction of China or Russia.
The main software bans apply from the 2027 vintage. Those for connectivity equipment apply to the 2030 vintage, or 1 January 2029 for non-associated vintage equipment. The vintage of a vehicle is not always confused with its calendar year of marketing.
The text also contains restrictions on the sale of connected vehicles by manufacturers themselves linked to these two countries. Its initial perimeter covers vehicles of less than 10 001 pounds, or about 4.5 tons. It does not constitute an indistinct prohibition of any Chinese coin in any automobile.
This policy treats dependency as a national security risk before a demonstrated compromise. It should not be presented as the conclusion of an investigation establishing that each vehicle targeted spied on its owner.
Europe has rules but must control access
The GDPR applies to processing of personal data within its scope, regardless of the nationality of the manufacturer. It requires a defined purpose, a legal basis, limited collection and adequate security. Transfers to third countries must comply with the guarantees provided for in the Regulation.
The European authorities set guidelines for connected vehicles as early as 2021. In France, CNIL published an updated recommendation on location data on 30 June 2026. In particular, it recalls the requirement of consent for their use, except where necessary for a specifically requested service, under the ePrivacy rules.
The question gets complicated when a car changes driver. A rental or family vehicle may record the travel of several persons. Information, user profiles and the exercise of rights must take this into account. The owner’s consent does not resolve all situations.
Another aspect concerns certification. International regulations R155 and R156 regulate the management of cybersecurity and software updates respectively. The European Union has incorporated them into its requirements for the categories concerned. They organise risk management during the life of the vehicle; they do not certify the absolute impossibility of an intrusion.
Nor has Europe ignored industrial dependency. On 13 February 2026, Member States, the Commission and ENISA presented a risk assessment of connected and automated vehicles. It accompanies a non-binding toolbox on the security of digital supply chains. This work is distinct from the recent assessment request for BYD.
The authorities also have procedures for monitoring the car market. In case of risk or non-compliance, they may impose corrections, restrictions or reminders. Their effectiveness depends on the ability to control the systems and then track their software developments.
Data protection, computer security and national defence thus answer different questions. A vehicle may comply with an approval procedure and remain excluded from a sensitive site. A local ban does not, in turn, demonstrate a violation of the GDPR.
GM, Volkswagen and Kia: risk exceeds China
Cases involving other groups prevent the problem from being reduced to a national origin. On October 30, 2026, the Attorney General of North Carolina announced a $220 million agreement with General Motors. It settles charges of unauthorized collection and resale of driving and location data via OnStar Smart Driver.
In particular, the US authorities accused GM of insufficiently transparent registrations and transmissions to intermediaries. The data could then be used by insurers. The agreement requires explicit consent and protective measures. This is a settlement of charges, not a Chinese spy case.
The Federal Trade Commission had already finalized an order against GM and OnStar on 14 January 2026. It prohibits for five years certain transmissions of location and behaviour data to consumer information agencies. Other transparency and control obligations span 20 years.
In December 2024, researchers also presented the data exhibition for approximately 800,000 Volkswagen electric vehicles. Travel information and homeowner contact information were accessible without adequate protection. The failure involved Cariad, its software subsidiary. The group indicated that it had corrected the problem and had not found abuse by third parties.
In the same year, researchers documented a vulnerability of Kia services allowing remote controls on compatible vehicles. They reported the flaw and then announced its correction before the publication of their demonstration. Their report states that no malicious exploitation had been found by Kia.
These files show three different problems: the disputed commercial use of data, their accidental exposure and the possible diversion of connected functions. They justify demanding checks for all manufacturers. They do not erase the particular questions posed by laws and the power relations between States.
What a buyer or fleet manager can ask
A buyer can check the functions actually enabled, the application permissions, and how to delete before a resale. He can ask what data is stored, where and for how long. Disable an optional function can reduce collection, but also remove a useful service. Security updates should not be overlooked.
For a sensitive administration or operator, the verification must go further. The contract may require flow mapping, independent audits and access control of providers. Procedures must include driver change, rental restitution and incident handling.
The requests made by MEPs in November relate precisely to this transition from declaration to control. The expected stage remains a documented assessment of access, software and uses near sensitive infrastructure. It will determine which restrictions are necessary, for which vehicles and in what situations.
Comments